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Foreword 



rd , 



This Technical Specification has been produced by the 3 Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 



This document has been prepared by the 3GPP Task Force, and contains an example set of algorithms which may be 
used as the GSM authentication and key generation functions A3 and A8. (It is not mandatory that the particular 
algorithms specified in this document are used - the A3 and A8 functions are operator-specifiable rather than being fully 
standardised). 
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Scope 



The present document contains an example set of algorithms which may be used as the GSM authentication and key 
generation functions A3 and A8. (It is not mandatory that the particular algorithms specified in this document are used - 
the A3 and A8 functions are operator-specifiable rather than being fully standardised). 

Section 3 (normative) introduces the algorithms and describes their input and output parameters. Section 4 (normative) 
defines the algorithms. Section 5 (informative) describes an alternative algorithm that some operators may prefer. 
Section 6 (informative) provides test data. 



References 



The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

[1] 3GPP TS 35.206: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example 
algorithm set for the 3GPP authentication and key generation functions fl, fl*, f2, O, f4, f5 and 
f5*; Document 2: Algorithm specification". 

[2] 3GPP TS 35.207: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example 
algorithm set for the 3GPP authentication and key generation functions fl, fl*, f2, G, f4, f5 and 
f5*; Document 3: Implementors' test data". 

[3] 3GPP TS 35.208: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the MILENAGE Algorithm Set: An example 
algorithm set for the 3GPP authentication and key generation functions fl, fl*, f2, G, f4, f5 and 
f5*; Document 4: Design conformance test data". 

[4] 3GPP TS 33.102 version 3.10.0: "3rd Generation Partnership Project; Technical Specification 

Group Services and System Aspects; 3G Security; Security architecture (Release 1999)". 

[5] 3GPP TS 03.20 version 8. 1 .0: "3rd Generation Partnership Project; Digital cellular 

telecommunications system (Phase 2+); Security related network functions (Release 1999)". 



Introductory information (normative) 



3.1 Introduction 

Within the security architecture of the GSM system there are security functions A3 and A8. The operation of these 
functions falls completely within the domain of an individual operator, and the functions are therefore to be specified by 
each operator rather than being fully standardised. The algorithms specified in this document are examples that may be 
used by an operator who does not wish to design his own. 

The inputs and outputs of the two functions are defined in section 3.2. 
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3.2 Algorithm Inputs and Outputs 

The inputs to the algorithms are given in table 1 , the outputs in tables 2 and 3 below. 

Table 1 : Inputs to A3 and A8 



Parameter 


Size (bits) 


Comment 


Ki 


128 


Subscriber key Ki[0]...Ki[127] 


RAND 


128 


Random challenge RAND[0]...RAND[127] 


Table 2: A3 output 


Parameter 


Size (bits) 


Comment 


SRES 


32 


Signed response SRES[0]...SRES[31] 


Table 3: A8 output 


Parameter 


Size (bits) 


Comment 


Kc 


64 


Cipher key Kc[0]...Kc[63] 



3.3 



Notation 



3.3.1 Bit/Byte ordering 

All data variables in this specification are presented with the most significant bit (or byte) on the left hand side and the 
least significant bit (or byte) on the right hand side. Where a variable is broken down into a number of substrings, the 
leftmost (most significant) substring is numbered 0, the next most significant is numbered 1, and so on through to the 
least significant. When a variable, with bit length L, is shown in hexadecimal format, bit is the most significant bit of 
the leftmost hexadecimal digit, and bit L-1 is the least significant bit of the rightmost hexadecimal digit. 



3.3.2 List of Symbols 

= The assignment operator. 

II The concatenation of the two operands. 

© The bitwise exclusive-OR operation. 

a) X[i] The i* bit of the variable X. (X = X[0] II X[l] II X[2] 



4 The GSM-MILENAGE algorithms (normative) 

An example algorithm set for UMTS, called MILENAGE (note 1), is specified in [1]. GSM-MILENAGE makes use of 
MILENAGE. 

Specifically, the functions from the UMTS MILENAGE which we make use of are the following (we prefix all input 
and output names by "MIL3G-" to distinguish them clearly from the inputs and outputs of A3 and A8): 
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Function 


Inputs 


Output 


f2 


MIL3G-K[0]...MIL3G-K[127] 
MIL3G-RAND[0]...MIL3G-RAND[127] 


MIL3G-RES[0]...MIL3G-RES[63] 


f3 


MIL3G-GK[0]...MIL3G-GK[127] 


f4 


MIL3G-IK[0]...MIL3G-IK[127] 



The GSM-MILENAGE functions are defined as follows: 

- Let (MIL3G-K[0]...MIL3G-K[127]) = (K,[0]...K,[127]) 

- Let (MIL3G-RAND[0]...MIL3G-RAND[127]) = (RAND[0]...RAND[127]) 

- Compute MIL3G-RES, MIL3G-CK and MIL3G-IK from MIL3G-K and MIL3G-RAND, using the MILENAGE 
functions /2,/3, and/4 respectively 

- Set (Kc[0] . . .Kc[63]) = (MIL3G-CK[0] . . .MIL3G-CK[63]) 8 

(MIL3G-CK[64]...MIL3G-CK[127]) © 
(MIL3G-IK[0]...MIL3G-IK[63]) © 
(MIL3G-IK[64] . . .MIL3G-IK[127]) 

Derive SRES from MIL3G-RES using an operator-selected SRES Derivation Function. This function must be 
precisely specified for the GSM-MILENAGE A3 algorithm to be fully defined. The two main recommended 
options are as follows (note 2): 

Recommended SRES Derivation Function #1: 

(SRES[0]...SRES[31]) = (MIL3G-RES[0]...MIL3G-RES[31]) © (MIL3G-RES[32]...MIL3G-RES[63]). 

Recommended SRES Derivation Function #2: 
(SRES[0]...SRES[31]) = (MIL3G-RES[0]...MIL3G-RES[31]). 

Alternative SRES Derivation Functions may be specified. 

NOTE 1: MILENAGE uses a 128-bit operator-specific constant OP; a value has to be assigned to this constant for 
MILENAGE to be fully specified. 

NOTE 2: The 3GPP standard conversion function to derive a GSM SRES of 32 bits from a UMTS XRES of up to 
128 bits is as follows [4]: 

SRES = XRES*1 xor XRES*2 xor XRES*3 xor XRES*4, where XRES* is 16 octets long and XRES* = 
XRES if XRES is 16 octets long and XRES* = XRES II 0...0 if XRES is shorter than 16 octets, XRES*i 
are all 4 octets long and XRES* = XRES*1 II XRES*2 II XRES*3 II XRES*4 

Recommended SRES Derivation Function #1 is the result of applying this standard conversion function to 
a 64-bit XRES equal to MIL3G-RES[0]...MIL3G-RES[63] from MILENAGE. Recommended SRES 
Derivation Function #2 is the result of applying this standard conversion function to a 32-bit XRES equal 
to MIL3G-RES[0] . . .MIL3G-RES[3 1] from MILENAGE. 



5 An alternative algorithm (informative) 

The GSM-MILENAGE algorithms defined in section 3 are obtained by applying standard 3G-to-2G conversion 
functions defined in [4] to the outputs of the UMTS MILENAGE algorithms. 

If there is no desire to retain this compatibility with UMTS MILENAGE used in its 2G mode, a much simpler and more 
efficient algorithm would be to set TEMP = Ek; (RAND), where E is the 128-bit block cipher used as a basic building 
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block in MILENAGE, i.e. TEMP = the result of encrypting RAND using the key K^; then choose non-overlapping 
substrings of TEMP to be SRES and Kc, e.g. SRES = TEMP[0]...TEMP[31] and Kc = TEMP[64]...TEMP[127]. 

This alternative does not form any part of the GSM-MILENAGE algorithms; it is included just for information. 



Test data for GSM-MILENAGE (informative) 



6.1 



Introduction 



The test data sets presented here are derived directly from the MILENAGE test sets in [3]. 



6.2 



Format 



The format of each test data set is as follows: 



Test Set n 


Ki 


subscriber secret key 


RAND 


random challenge 


OP 


operator-specific MILENAGE constant 


OPc 


derived from OP and Ki — see [1] 


MIL3G-RES 


MILENAGE /2 output, included for information only 


SRES#1 


A3 output SRES, if Recommended SRES Derivation Function 
#1 is used — see section 4, page 7 


SRES#2 


A3 output SRES, if Recommended SRES Derivation Function 
#2 is used — see section 4, page 7 


MIL3G-CK 


MILENAGE /3 output, included for information only 


MIL3G-IK 


MILENAGE f4 output, included for information only 


Kc 


A8 output (cipher key) 



All test data in this tabular format is shown in hexadecimal representation. The first test set is also shown in binary, to 
show explicitly the relationship between the binary data and the hexadecimal representation. 
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6.3 



Test Sets 



Test Set 1 in binary format 


Ki 


01000110 01011011 01011100 11101000 10110001 10011001 10110100 
10011111 10101010 01011111 00001010 00101110 11100010 00111000 
10100110 10111100 


RAND 


00100011 01010101 00111100 10111110 10010110 00110111 10101000 
10011101 00100001 10001010 11100110 01001101 10101110 01000111 
10111111 00110101 


OP 


11001101 11000010 00000010 11010101 00010010 00111110 00100000 
11110110 00101011 01101101 01100111 01101010 11000111 00101100 
10110011 00011000 


OPc 


11001101 01100011 11001011 01110001 10010101 01001010 10011111 
01001110 01001000 10100101 10011001 01001110 00110111 10100000 
00101011 10101111 


MIL3G-RES 


10100101 01000010 00010001 11010101 11100011 10111010 01010000 
10111111 


SRES#1 


01000110 11111000 01000001 01101010 


SRES#2 


10100101 01000010 00010001 11010101 


MIL3G-CK 


10110100 00001011 10101001 10100011 11000101 10001011 00101010 
00000101 10111011 11110000 11011001 10000111 10110010 00011011 
11111000 11001011 


MIL3G-IK 


11110111 01101001 10111100 11010111 01010001 00000100 01000110 
00000100 00010010 01110110 01110010 01110001 00011100 01101101 
00110100 01000001 


Kc 


11101010 11100100 10111110 10000010 00111010 11111001 10100000 
10001011 



Test Set 1 


Ki 


465b5ce8 


bl99b49f 


aaSf 0a2e 


e238a6bc 


RAND 


23553cbe 


9637a89d 


218ae64d 


ae47bf35 


OP 


cdc202d5 


123e20f6 


2b6d676a 


c72cb318 


OPc 


cd63cb71 


954a9f4e 


48a5994e 


37a02baf 


MIL3G-RES 


a54211d5 


e3ba50bf 






SRES#1 


46f8416a 


SRES#2 


a54211d5 


MIL3G-CK 


b40ba9a3 


C58b2a05 


bbf0d987 


b21bf8cb 


MIL3G-IK 


f769bcd7 


51044604 


12767271 


Ic6d3441 


Kc 


eae4be82 


3af9a08b 







Test Set 2 


Ki 


fec86ba6 


eb707ed0 


8905757b 


Ibb44b8f 


RAND 


9f7c8d02 


laccf4db 


213ccff0 


C7f71a6a 


OP 


dbc59adc 


b6f9a0ef 


735477b7 


fadf8374 


OPc 


1006020f 


0a478bf6 


b699fl5c 


062e42b3 


MIL3G-RES 


8011c48c 


0c214ed2 






SRES#1 


8c308a5e 


SRES#2 


8011c48c 


MIL3G-CK 


5dbdbb2 9 


54e8f3cd 


e665b046 


179a5098 


MIL3G-IK 


59a92d3b 


476a0443 


487055cf 


88b2307b 


Kc 


aa01739b 


8caa976d 
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Test Set 3 


Ki 


9e5944ae 


a94b8116 


5c82fbf9 


f32db751 


RAND 


ce83dbc5 


4ac0274a 


157cl7f8 


0d017bd6 


OP 


223014C5 


806694C0 


07caleee 


f57f004f 


OPc 


a64a507a 


ela2a98b 


b88eb421 


0135dc87 


MIL3G-RES 


f365cd68 


3cd92e96 






SRES#1 


cfbceSf e 


SRES#2 


f365cd68 


MIL3G-CK 


e203edb3 


971574f5 


a94bOd61 


b816345d 


MIL3G-IK 


0c4524ad 


eac041c4 


dd830d20 


854fc46b 


Kc 


9a8ec95f 


408CC507 







Test Set 4 


Ki 


4abldebO 


5ca6ceb0 


51fc98e7 


7d026a84 


RAND 


74bOcd60 


31alc833 


9b2b6ce2 


b8c4al86 


OP 


2dl6c5cd 


Ifdf6b22 


38358463 


bef2a8d8 


OPc 


dcf07cbd 


51855290 


b92a07a9 


891e523e 


MIL3G-RES 


5860fclb 


ce351e7e 






SRES#1 


9655e265 


SRES#2 


5860fclb 


MIL3G-CK 


7657766b 


373dlc21 


38f307e3 


de9242f9 


MIL3G-IK 


Ic42e960 


d89b8fa9 


9f2744e0 


708ccb53 


Kc 


cdcldc08 


41b81a22 







Test Set 5 


Ki 


6c38all6 


ac280c45 


4f59332e 


e35c8c4f 


RAND 


ee6466bc 


96202c5a 


5 5 7abbef 


f8babf63 


OP 


IbaOOala 


7c6700ac 


8c3ff3e9 


6ad08725 


OPc 


3803ef53 


63b947c6 


aaa225e5 


8fae3934 


MIL3G-RES 


16c8233f 


05a0ac28 






SRES#1 


13688fl7 


SRES#2 


16c8233f 


MIL3G-CK 


3f8c7587 


fe8e4b23 


3af676ae 


de30ba3b 


MIL3G-IK 


a7466ccl 


e6b2al33 


7d49d3b6 


6e95d7b4 


Kc 


df75bc5e 


a899879f 







Test Set 6 


Ki 


2d609d4d 


bOacSbfO 


d2c0de26 


7014deOd 


RAND 


194aa756 


013896b7 


4b4a2a3b 


0af4539e 


OP 


460a4838 


5427aa39 


264aac8e 


fc9e73e8 


OPc 


c35a0ab0 


bcbfc925 


2caffl5f 


24efbde0 


MIL3G-RES 


8c25al6c 


d918aldf 






SRES#1 


553d00b3 


SRES#2 


8c25al6c 


MIL3G-CK 


4cd08460 


20f8fa07 


31dd47cb 


dc6be411 


MIL3G-IK 


88ab80a4 


15fl5c73 


711254al 


d388f696 


Kc 


84b417ae 


3aeab4f3 
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Test Set 7 


Ki 


a530a7fe 


428fadl0 


82c45edd 


fcel3884 


RAND 


3a4c2b32 


45c50eb5 


c71d0863 


9395764d 


OP 


511c6c4e 


83e38c89 


blc5d8dd 


e62426fa 


OPc 


27953649 


bc8af6dc 


c6e730eb 


80286be3 


MIL3G-RES 


a63241el 


ffc3e5ab 






SRES#1 


59fla44a 


SRES#2 


a63241el 


MIL3G-CK 


lOfOSbab 


75a99a5f 


bb98a9c2 


87679c3b 


MIL3G-IK 


f9ec0865 


eb32f223 


69cade40 


C59c3a44 


Kc 


3b4e244c 


dc60ce03 







Test Set 8 


Ki 


d9151cf0 


4896e258 


30bf2e08 


267b8360 


RAND 


f761e5e9 


3d603feb 


730e2755 


6cb8a2ca 


OP 


75fc2233 


a44294ee 


8e6de25c 


4353d26b 


OPc 


c4c93eff 


e8a08138 


c203d4c2 


7ce4e3d9 


MIL3G-RES 


4a90b217 


Iac83a76 






SRES#1 


50588861 


SRES#2 


4a90b217 


MIL3G-CK 


71236b71 


29f9b22a 


b77ea7a5 


4c96da22 


MIL3G-IK 


90527eba 


a5588968 


db417273 


25a04d9e 


Kc 


8d4ec01d 


e597acfe 







Test Set 9 


Ki 


a0e2971b 


6822e8d3 


54al8cc2 


35624ecb 


RAND 


08eff828 


bl3fdb56 


2722c65c 


7f30a9b2 


OP 


323792fa 


ca21fb4d 


5d6fl3cl 


45a9d2cl 


OPc 


82a26f22 


bba9e948 


8f949al0 


d98e9cc4 


MIL3G-RES 


4bc2212d 


8624910a 






SRES#1 


cde6b027 


SRES#2 


4bc2212d 


MIL3G-CK 


08cef6d0 


04ec6147 


Ia3c3cda 


048137fa 


MIL3G-IK 


ed0318ca 


5deb9206 


272f6e8f 


a64ba411 


Kc 


d8debc4f 


fbcd60aa 







Test Set 1 


Ki 


0da6f7ba 


86d5eac8 


al9cf563 


ac58642d 


RAND 


679ac4db 


acd7d233 


ff9d6806 


f4149ce3 


OP 


4b9a26fa 


459e3acb 


ff36f401 


5de3bdcl 


OPc 


0dbl071f 


8767562c 


a43a0a64 


C41e8d08 


MIL3G-RES 


6fc30fee 


6dl23523 






SRES#1 


02dl3acd 


SRES#2 


6fc30fee 


MIL3G-CK 


69blcae7 


C7429d97 


5e245cac 


b05a517c 


MIL3G-IK 


74f24e8c 


26df58el 


b38d7dcd 


4flb7fbd 


Kc 


f Oeaa50a 


ledcebb7 
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Test Set 11 


Ki 


77b45843 


c88e58cl 


0d202684 


515ed430 


RAND 


4c47eb30 


76dc55fe 


5106cb20 


34b8cd78 


OP 


bf3286c7 


a51409ce 


95724d50 


3bfe6e70 


OPc 
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Annex A (informative): 
Change history 



Change history | 


Date 


TSG# 


TSG Doc. 


CR 


Rev 


Cat 


Subject/Comment 


Old 


New 


2002-05 


- 






- 




ETSI SAGE version 1 .0 produced and forwarded to SA WG3 
for approval. 




SAGE 
1.0 


2002-12 


SP-18 


SP-020724 








Approved by SA WG3 meeting #26 (S3-020675). Editorial 
update to change MILENAGE-2G to GSM-MILENAGE and 
correction to references. Updated to 3GPP TS format 
(Technically equivalent to ETSI SAGE version 1 .0). 
Presentation to TSG SA#18 for approval (Release 6). 


SAGE 
1.0 


1.0.0 


2002-12 


SP-18 


- 


- 


- 


- 


Approved at TSG SA#18. Updated to Version 6.0.0 for 
publication (Rel-6) 


1.0.0 


6.0.0 


2003-12 


SP-22 


SP-030606 


0001 


- 


D 


Correction of reference 


6.0.0 


6.1.0 


2006-03 


SP-31 


SP-060057 


0002 


- 


F 


Clarifying the Bit/Byte ordering and symbols for GSM- 
MILENAGE example algorithm 


6.1.0 


6.2.0 


2007-06 


SP-36 






- 




Update to Rel-7 version (MCC) 


6.2.0 


7.0.0 


2008-12 


SP-42 


- 


- 


- 


- 


Update to Rel-8 version (MCC) 


7.0.0 


8.0.0 


2009-12 


- 


- 


- 


- 


- 


Update to Rel-9 version (MCC) 


8.0.0 
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